findus spoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

findus spoofer.exe
Size

1.4MB
MD5

bf2c75e2b17d0a0dee2b2d6693c67163
SHA1

c912f578c37e8927cb164005e4c449d04a78f9ab
SHA256

0acf6c86d382e37b554ccf49214a0ac1c32eab734d10643581454e82a5bf23d0
SHA512

2cc997df337e6a3f393a2961234f85e0cefa31f1d23442259a25d2a45a59453262f509737167527652d4cbd0e1b1a53e97b286a2c8ecf2eb9e5284b246f8ef3b
SSDEEP

24576:6LM5vNJjDBAOySeTQcPTAcySiDNpfVkqgfPyU8/oa8reuaD9h6:7FJjDaOyN70nS4pfVkqgy6r3aj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
findus spoofer.exe

Files

findus spoofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\fffea\Desktop\findus downloads\findus spoofer\pulse\pulse\obj\Release\findus spoofer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ